CWE-203 · Observable Discrepancy (page 5)
Page 5 of 8 — CVEs classified under CWE-203, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28840 | High | 7.5 | 2023-04-04 | Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream pro… |
CVE-2023-25000 | Medium | 5.0 | 2023-03-30 | HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access… |
CVE-2023-26071 | High | 7.5 | 2023-03-28 | An issue was discovered in MCUBO ICT through 10.12.4 (aka 6.0.2). An Observable Response Discrepancy can occur under the login web page. In particular, the web… |
CVE-2022-41354 | Medium | 4.3 | 2023-03-27 | An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. |
CVE-2023-1540 | Medium | 5.3 | 2023-03-21 | Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2023-1538 | Medium | 5.3 | 2023-03-21 | Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2021-46876 | Medium | 5.3 | 2023-03-12 | An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence. |
CVE-2023-25806 | Medium | 5.3 | 2023-03-02 | OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authenticati… |
CVE-2022-39228 | Medium | 5.3 | 2023-03-01 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password co… |
CVE-2020-12413 | Medium | 5.9 | 2023-02-16 | The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ci… |
CVE-2023-0361 | High | 7.4 | 2023-02-15 | A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encryp… |
CVE-2022-4304 | Medium | 5.9 | 2023-02-08 | A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichen… |
CVE-2023-0440 | Medium | 5.3 | 2023-01-23 | Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6. |
CVE-2010-10006 | Low | 2.6 | 2023-01-18 | A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/… |
CVE-2022-3143 | High | 7.4 | 2023-01-13 | wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in sev… |
CVE-2022-42288 | Medium | 5.3 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an… |
CVE-2022-4499 | High | 7.5 | 2023-01-11 | TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-chann… |
CVE-2022-4543 | Medium | 5.5 | 2023-01-11 | A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch si… |
CVE-2022-30332 | Medium | 5.3 | 2023-01-10 | In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depen… |
CVE-2022-48251 | High | 7.5 | 2023-01-10 | The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offe… |
CVE-2016-15015 | Low | 2.6 | 2023-01-08 | A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of… |
CVE-2022-4025 | Medium | 4.3 | 2023-01-02 | Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an iframe via a crafte… |
CVE-2013-10006 | Low | 2.6 | 2023-01-01 | A vulnerability classified as problematic was found in Ziftr primecoin up to 0.8.4rc1. Affected by this vulnerability is the function HTTPAuthorized of the fil… |
CVE-2022-47952 | Low | 3.3 | 2023-01-01 | lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree… |
CVE-2022-4823 | Low | 3.1 | 2022-12-28 | A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_control… |
CVE-2021-4294 | Low | 2.6 | 2022-12-28 | A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipu… |
CVE-2021-4286 | Low | 2.6 | 2022-12-27 | A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp… |
CVE-2022-41765 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidde… |
CVE-2022-44381 | Medium | 5.3 | 2022-12-25 | Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request. |
CVE-2022-45416 | Medium | 6.5 | 2022-12-22 | Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have… |
CVE-2022-45403 | Medium | 6.5 | 2022-12-22 | Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range… |
CVE-2022-34477 | High | 7.5 | 2022-12-22 | The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource… |
CVE-2022-31742 | Medium | 6.5 | 2022-12-22 | An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles… |
CVE-2022-26382 | Medium | 4.3 | 2022-12-22 | While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text b… |
CVE-2022-20559 | Low | 3.3 | 2022-12-16 | In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to si… |
CVE-2022-20538 | Medium | 5.5 | 2022-12-16 | In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel infor… |
CVE-2022-20535 | Low | 3.3 | 2022-12-16 | In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is installed, without query permissions, due… |
CVE-2022-46392 | Medium | 5.3 | 2022-12-15 | An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically… |
CVE-2022-3907 | High | 7.5 | 2022-12-05 | The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operat… |
CVE-2022-4087 | Low | 2.6 | 2022-11-21 | A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of… |
CVE-2022-45163 | Medium | 5.3 | 2022-11-18 | An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX R… |
CVE-2022-41914 | Low | 3.7 | 2022-11-16 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Ser… |
CVE-2022-20940 | Medium | 5.3 | 2022-11-15 | A vulnerability in the TLS handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain access to sensitive… |
CVE-2020-35473 | Medium | 4.3 | 2022-11-08 | An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended sca… |
CVE-2021-45925 | Medium | 5.3 | 2022-10-24 | Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST250… |
CVE-2022-40084 | Medium | 5.3 | 2022-10-20 | OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which co… |
CVE-2022-43412 | Medium | 5.3 | 2022-10-19 | Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook… |
CVE-2022-43411 | Medium | 5.3 | 2022-10-19 | Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal… |
CVE-2021-36201 | Medium | 4.3 | 2022-10-11 | Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions. |
CVE-2022-2891 | Medium | 5.9 | 2022-10-10 | The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the… |
CVE-2022-40895 | Critical | 9.1 | 2022-10-06 | In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity… |
CVE-2022-35888 | Medium | 6.5 | 2022-09-29 | Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret informatio… |
CVE-2022-32218 | Medium | 4.3 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumer… |
CVE-2022-36105 | Medium | 5.3 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user aut… |
CVE-2022-37146 | Medium | 5.3 | 2022-09-08 | The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the… |
CVE-2022-1989 | Medium | 5.3 | 2022-08-23 | All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to en… |
CVE-2022-37459 | High | 7.8 | 2022-08-17 | Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hij… |
CVE-2022-2612 | Medium | 6.5 | 2022-08-12 | Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process t… |
CVE-2022-20324 | Medium | 5.5 | 2022-08-12 | In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This cou… |
CVE-2022-20320 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2022-20318 | Low | 3.3 | 2022-08-12 | In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2022-20316 | Low | 3.3 | 2022-08-12 | In ContentResolver, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2022-20309 | Low | 3.3 | 2022-08-12 | In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2022-20307 | Low | 3.3 | 2022-08-12 | In AlarmManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20304 | Medium | 5.5 | 2022-08-12 | In Content, there is a possible way to determinate the user's account due to side channel information disclosure. This could lead to local information disclosu… |
CVE-2022-20293 | Medium | 5.5 | 2022-08-12 | In LauncherApps, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20291 | Medium | 5.5 | 2022-08-12 | In AppOpsService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20279 | Medium | 5.5 | 2022-08-12 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20277 | Medium | 5.5 | 2022-08-12 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20276 | Medium | 5.5 | 2022-08-12 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20275 | Medium | 5.5 | 2022-08-12 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20252 | Low | 3.3 | 2022-08-11 | In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2022-20251 | Low | 3.3 | 2022-08-11 | In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20249 | Low | 3.3 | 2022-08-11 | In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20242 | Medium | 5.5 | 2022-08-11 | In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This cou… |
CVE-2021-0975 | Medium | 5.5 | 2022-08-11 | In USB Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2021-46778 | Medium | 5.6 | 2022-08-10 | Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that us… |
CVE-2022-20866 | High | 7.4 | 2022-08-10 | A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwa… |
CVE-2022-34704 | Medium | 4.7 | 2022-08-09 | Windows Defender Credential Guard Information Disclosure Vulnerability |
CVE-2022-24912 | High | 7.5 | 2022-07-29 | The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which… |
CVE-2022-36885 | Medium | 5.3 | 2022-07-27 | Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are eq… |
CVE-2022-1146 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2022-1139 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2022-32425 | Medium | 5.3 | 2022-07-14 | The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time. |
CVE-2022-31142 | High | 7.5 | 2022-07-14 | @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use… |
CVE-2022-20752 | Medium | 5.3 | 2022-07-06 | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cis… |
CVE-2021-41634 | Medium | 5.3 | 2022-06-24 | A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames. |
CVE-2022-34174 | High | 7.5 | 2022-06-23 | In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an… |
CVE-2022-24436 | Medium | 6.5 | 2022-06-15 | Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure… |
CVE-2022-23823 | Medium | 6.5 | 2022-06-15 | A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable i… |
CVE-2022-27221 | Medium | 5.9 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret v… |
CVE-2022-0823 | Medium | 6.2 | 2022-06-09 | An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing… |
CVE-2022-32273 | Medium | 4.3 | 2022-06-08 | As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate fi… |
CVE-2022-29185 | Medium | 4.2 | 2022-05-20 | totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token compa… |
CVE-2022-24043 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2021-33149 | Medium | 5.5 | 2022-05-12 | Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. |
CVE-2021-46744 | Medium | 6.5 | 2022-05-11 | An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time. |
CVE-2021-33845 | Medium | 5.3 | 2022-05-06 | The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances b… |
CVE-2022-1318 | Medium | 6.2 | 2022-04-20 | Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicio… |
CVE-2022-27814 | Low | 3.3 | 2022-04-14 | SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option. |